This application claims the priority of German patent document no. 10 2008 061 276.6-55, filed Dec. 10, 2008, the disclosure of which is expressly incorporated by reference herein.
The invention relates to a method and apparatus for integrity communication in a navigation satellite system.
Satellite systems for worldwide navigation, referred to as GNSS (Global Navigation Satellite System, abbreviated navigation satellite system) are used for position determination on the ground and in the air. GNSS systems, such as the European Navigation Satellite System (also called the Galileo System, or simply “Galileo”, which is currently under construction, include a satellite system (space segment) comprising a plurality of satellites, and an earth-fixed reception equipment system (ground segment). The latter is connected with a central computation station and comprises several ground stations as well as Galileo sensor stations (GSS) and user systems which analyze and use the satellite signals transmitted from the satellites by radio particularly for the navigation. Each satellite in the space segment emits a signal, referred to as the signal-in-space (SIS) characterizing the satellite. In particular, the SIS comprises information concerning the orbit of the satellite and a time stamp of the emission point in time; the latter are used for detecting the position of a user or user system.
Accurate detection of the position of a user requires integrity in the case of a GNSS, meaning that, on the one hand, the GNSS is capable of warning a user within a defined time period when parts of the GNSS should not be used for the navigation (for example, in the event of a failure of system components), and on the other hand that the user can trust the navigation data, which the user receives from the satellites of the GNSS by way of satellite navigation signals, and particularly can rely on the accuracy of the received navigation data.
In the integrity concept of the Galileo, the following information is transmitted to user systems in the form of navigation signals:                The predicted accuracy of the transmitted navigation signal for each satellite (i.e., a signal-in-space accuracy (SISA) of satellites as a quality measurement for an SIS of a satellite);        Status reports concerning the predicted accuracy of the satellite signal monitoring by the ground segment (i.e., a signal-in-space monitoring accuracy (SISMA) for each satellite); and        An integrity signal in the form of a simple error flag for a faulty SIS of a satellite “Not OK” (the so-called integrity flag IF), and the threshold value for the report that the error of an SIS of a satellite is no longer acceptable (also called an IF threshold). In this case, the IF threshold may be a function of the SISA and the SISMA.        
This information enables the user system itself to quantify and evaluate the integrity and the integrity risk.
In Galileo, the signals in space of the satellites are monitored within the ground segment by analyzing the measurements from the individual Galileo sensor stations (GSS). The measurements of the GSS are processed in a central integrity processing center of the ground segment in order to determine the above-listed integrity information to be distributed to the user systems.
Based on the known positions of the GSS in the integrity processing center, the current position of a satellite, the time momentarily physically implemented in the satellite and the quality of the emitted signal, and thus the error of the satellite or of the signal in space (the so-called signal-in-space error, or “SISE”) emitted by the satellite are estimated.
A prediction of the distribution of the SISE can be derived from a normal distribution with the smallest standard deviation. This representation can take place, for example, in accordance with the overbounding. This prediction is designated as the above-mentioned signal-in-space accuracy (SISA) which is distributed by the ground segment by way of the satellites of the space segments to the user systems. In the above-mentioned sense, the difference between the current 4-dimensional position (orbit and time of day) of a satellite and the predicted 4-dimensional position contained in the navigation message, can be described by means of the SISA.
However, estimating the SISE is a process prone to errors. As a rule, it is therefore assumed that the distribution of the actual SISE about the value of the estimated SISE can be described by a normal distribution, with the standard deviation which is indicated as the above-mentioned signal-in-space monitoring accuracy (SISMA). The SISMA is therefore a measurement for the accuracy of the estimation of the SISE for a satellite in the ground segment, and is also transmitted, from the ground segment to the user systems by way of the satellites of the space segment SISMA. In Galileo, the SISMA values for the satellites are transmitted approximately every 30 seconds. In order to reduce the integrity risk to the extent possible, the highest SISMA value of the respective SISMA values predicted in a measuring period is transmitted for each satellite. In this case, a high SISMA value indicates a low accuracy of satellite monitoring by the ground segment, and thus reflects an increased integrity risk for a user.
Furthermore, when determining the SISMA of a satellite whose navigation signals are measured by several GSSs, the failure of precisely one GSS of the GSSs provided for the measuring can be taken into account, so that the SISMA value is increased again because the measuring accuracy suffers from the failure. For differentiation from the conventional SISMA, a SISMA determined in this manner is called a broadcast SISMA. More precisely, the broadcast SISMA is a function of the measurements of the GSSs visible from the satellite and made available to the integrity processing center of the ground segment, and is computed with the assumption that the GSS is no longer providing data whose loss would cause the broadcast SISMA to rise the most. This leads to a very dense network of GSSs. In addition, very high broadcast SISMA values may be transmitted because the failure of one GSS is assumed, so that many user systems will classify the integrity risk as very high, and will possibly no longer use the GNSS, despite the fact that the actual SISMA has a much lower value and integrity would exist.
In order to avoid the above problems, it has been suggested to define in each case a maximal value in the form of a threshold value for the broadcast SISMA values, which threshold value is virtually never exceeded. However, this technique may cause a user system to underestimate its integrity risk and therefore erroneously to classify received navigation signals (and the information contained therein) as having integrity, specifically when actually a broadcast SISMA larger than the maximal value would have to be sent and the SISMA is also above this threshold value. In addition, by restricting the broadcast SISMA by an upper limit, the continuity risk will rise because it is no longer ensured in every case that, when a GSS fails, the user can continue to use for a defined time the SISMA being used by the user, because this loss had no longer been taken into account in the SISMA transmitted to the user.